Defence Cyber Certification
Book Free Consultation ›Helping defence sector suppliers strengthen organisational cyber resilience and gain a competitive edge through compliance.
Defence Cyber Certification (DCC) is a comprehensive cyber security certification framework developed by the UK Ministry of Defence (MOD) and IASME. It is designed specifically for organisations operating within the defence supply chain and aligns with UK Defence Standards and international best practice. The scheme provides a clear, structured way to demonstrate cyber resilience, governance, and good practice across your organisation.
The UK defence sector faces increasing cyber threats, and suppliers are expected to meet stringent security requirements. Yet many organisations remain exposed to vulnerabilities that could lead to contract loss, reputational damage, and regulatory penalties. DCC offers a trusted framework to mitigate these risks and build confidence with MOD, clients, and partners.
About Defence Cyber Certification
DCC helps organisations embed cyber security into their operations, from leadership and culture to technical controls, risk management, and supplier oversight. Certification provides a single, organisation-wide assurance that can be presented in support of UK Defence procurements.
The scheme includes four levels of certification, each aligned to the level of cyber risk associated with your role in the defence supply chain:
- Level 0: Foundational, 3 controls (requires Cyber Essentials)
- Level 1: Comprehensive, 101 controls (requires Cyber Essentials)
- Level 2: Advanced, 139 controls (requires Cyber Essentials Plus)
- Level 3: Expert, 144 controls (requires Cyber Essentials Plus)
All levels begin with Cyber Essentials certification, forming the foundation for higher standards.
The MOD will specify the required level of Defence Cyber Certification for each contract, based on the sensitivity of the work and associated risks. However, organisations can apply for certification at any level even if they do not currently hold an MOD contract. Choosing a higher level can strengthen your position in the defence supply chain and show commitment to best practice, while ensuring you meet or exceed potential contractual requirements.
Benefits of Defence Cyber Certification
Defence Cyber Certification FAQs
What is Defence Cyber Certification (DCC)?
Defence Cyber Certification (DCC) is a Ministry of Defence (MOD) scheme designed to ensure suppliers meet robust cyber security standards. It applies to organisations delivering outputs to MOD contracts, but any organisation can apply for certification, regardless of whether they currently hold a defence contract.
What levels of Defence Cyber Certification are available?
There are four levels of Defence Cyber Certification, each with an increasing number of controls. Level 0 covers basic cyber security practices with 3 controls. Level 1 is a comprehensive programme with good practices across 101 controls. Level 2 requires advanced oversight and planning across 139 controls. Level 3 represents expert capabilities using a ‘defence in depth’ approach across 144 controls.
How do I know which DCC level I need?
The MOD will specify the required DCC level for each contract you are bidding on or delivering. However, you can apply for any level even if you do not currently hold an MOD contract, which can be useful if you are positioning your organisation for future defence work or want to demonstrate cyber security maturity to other customers.
What is the DCC certification process with Evolve North?
The Defence Cyber Certification process with Evolve North has five stages. First, contact us to discuss your requirements. We will then explain the assessment process and provide an indicative cost. Once you sign an agreement, we schedule your assessment, our assessor reviews your compliance and advises on any gaps, and on successful completion you receive your certificate and digital badge.
How much does Defence Cyber Certification cost?
Costs vary based on business size, readiness, the certification level required, and the level of support needed to prepare. Because the four DCC levels range from 3 controls at Level 0 to 144 controls at Level 3, the assessment effort differs significantly. Contact Evolve North for a tailored quote based on your specific requirements.
How long does Defence Cyber Certification last?
Defence Cyber Certification certificates are valid for three years. During this period, annual attestation is required, along with recertification of your underlying Cyber Essentials or Cyber Essentials Plus certification, which is a prerequisite for all DCC levels.
Do I need Cyber Essentials to achieve Defence Cyber Certification?
Yes, all levels of Defence Cyber Certification require Cyber Essentials as a prerequisite. Levels 2 and 3 additionally require Cyber Essentials Plus, which involves an independent technical audit of your security controls rather than just a self-assessment questionnaire.
Can Evolve North help me prepare for DCC certification?
Yes, Evolve North provides consultancy support to help you prepare for Defence Cyber Certification. As a DCC Level 1 certified body ourselves, we understand the requirements at each level and can guide you through readiness assessment, control implementation and evidence gathering ahead of your formal assessment.
What happens if I fail a Defence Cyber Certification assessment?
If you do not pass a DCC assessment, you will receive a detailed report outlining the gaps identified during the assessment. You can then remediate those gaps and reapply for certification. Evolve North does not share failure details externally, so your application remains confidential while you work towards meeting the required standard.
Arrange a FREE Consultation
Evolve North provides specialist support to help you achieve Defence Cyber Certification. In a free consultation, we’ll walk you through the different certification levels, explain MOD requirements, and help you plan a pathway that aligns with your organisation’s objectives and future opportunities. Our approach ensures you have the guidance and confidence needed to meet the scheme’s standards and strengthen your cyber resilience.